The TCP/IP Drinking Game

I am no longer maintaining the TCP/IP Drinking Game. If you have
awesome questions you want to add to it, please start maintaining a
new version. If you do so, email me and I'll add a link to your
version from this page.

You can play the TCP/IP drinking game just about any way you want,
as long as you remember that the point is to have fun laughing at the
bizarre questions which no human being actually knows the answers to.
The way I usually play it is like this: Pass the cards around in a
circle. Each person asks a question of the person next in line. If
you get the wrong answer, drink to punish yourself. If you get the
right answer, drink to celebrate. If it was a particularly good
question, everyone drinks. Remember, nobody wins a drinking game.

Q: What should happen upon receipt of a RST packet containing data?

A: The host should accept it. It was suggested that a RST could contain ASCII text explaining the error, but no standard was ever established.

Credit: Kris Katterjohn

Q: What is the longest acceptable delay for an ACK?

A: 0.5 seconds.

Credit: Kris Katterjohn

Q: An ICMP error message must include what data from the original erring datagram?

A: The IP header and at least 8 bytes of payload.

Credit: Kris Katterjohn

Q: What is the major difference between Windows tracert and Van Jacobson-style UNIX traceroute?

A: To prevent a packet being retransmitted forever in the case of
a routing loop.

Credit: Jim Wilson

Q: What experimental protocol might be able to fulfill RFC 1122's requirement of "SHOULD: able to leap tall buildings at a single bound?"

A: CPIP, Carrier Pigeon Internet Protocol.

Credit: Helge Haftig

Q: What are the Dave Clark Five?

A: RFCs 813 through 817.

Credit: Telsa Gwynne

Q: What was the first remotely operated non-computer appliance to be connected to the Internet?

A: A toaster (controlled using SNMP).

Credit: Richard Lightman

Q: What is CPIP?

A: Carrier Pigeon Internet Protocol (see RFC 1149).

Credit: SL Baur

Q: What common multicast group uses the address 224.0.1.1?

A: NTP (Network Time Protocol).

Credit: Nivedita Singhvi

Q: What is the only field that is different between a regular ARP packet and a gratuitous ARP packet?

A: The target IP.

Credit: Nivedita Singhvi

Q: What error is returned if a UDP datagram is received and has a checksum error?

A: None. It is silently discarded.

Credit: Nivedita Singhvi

Q: What is the minimum IP datagram size that a host must be able to receive?

A: 576 bytes.

Credit: Nivedita Singhvi

Q: When is the transmitted UDP checksum 0?

A: When the sender did not compute it.

Credit: Nivedita Singhvi

Q: Which is the only field used twice in the UDP checksum calculation?

A: UDP length.

Credit: Nivedita Singhvi

Q: Why is a pad byte of 0 occasionally appended for the UDP checksum calculation?

A: Because the checksum algorithm requires an even number of bytes.

Credit: Nivedita Singhvi

Q: What are the 5 fields of a UDP pseudoheader?

A: Source IP, destination IP, zero, protocol, UDP length.

Credit: Nivedita Singhvi

Q: Which parts of the packet does the UDP checksum cover?

A: UDP pseudoheader, UDP header, UDP data.

Credit: Nivedita Singhvi

Q: Which parts of the packet does the IP checksum cover?

A: The IP header.

Credit: Nivedita Singhvi

Q: What is the maximum amount of data in a UDP packet over IPv4?

A: 65507 bytes (65535 - 20 IP header - 8 UDP header).

Credit: Nivedita Singhvi

Q: Who was the first individual member of the Internet Society?

A: Jon Postel, narrowly beating Steve Wolff.

Credit: Matthew Wilcox

Q: Why hasn't RFC 1149 been ratified?

Hint: RFC 1149 specifies an unusual encapsulation of IP.

A: The Avian Transmission Protocol has only been implemented once so far : http://www.blug.linux.no/rfc1149/

Credit: Matthew Wilcox

Q: How many identical acks need to be received for fast retransmit to occur?

A: 4 (3 duplicate + original).

Credit: Nivedita Singhvi

Q: Under what circumstances is the TCP checksum incorrect, on a well-formed, in-flight packet?

A: When the packet is using the IP source routing option (the destination IP changes along the route, which is used to calculate the TCP checksum).

Credit: Credit: Rusty Russell

Q: How many bytes total are in a standard sized ICMP echo request packet?

A: 84 bytes (56 data, 8 ICMP header, 20 IP header).

Credit: Credit: Linda J. Laubenheimer

Q: What does "IETF" stand for?

A: Internet Engineering Task Force.

Credit: Credit: Linda J. Laubenheimer

Q: What does SLIP stand for?

A: Serial Line Internet Protocol.

Credit: Credit: Ben Sittler

Q: What is the TCP retransmission ambiguity problem?

A: An ACK arrives after a retransmit - was it sent in response to the initial transmit or the retransmit?

Credit: Craig Latta

Q: Name one way to solve the TCP retransmission ambiguity problem.

A: Use the Eifel detection algorithm.

A: Enable timestamps (which is what Eifel does).

Credit: Craig Latta

Q: When is an IGMP report timer cancelled?

A: When the host receives an IGMP report for the same group (with a matching destination IP).

A: When more than one host is a member of the same group on the same network.

Credit: Craig Latta

Q: How many bits are in an "A" type DNS resource record?

A: 112, plus the owner name.

Credit: Craig Latta

Q: What is archived at www.kohala.com?

A: Richard Stevens' website.

Credit: Telsa Gwynne

Q: What does the tcp_close_wait_interval configuration option really do in Solaris?

A: Sets the duration of the TIME_WAIT state.

Credit: Laurel Fan

Q: What is the range of class B IP addresses?

A: 128.0.0.0 through 191.255.255.255.

Credit: Annie White

Q: What is the significance in networking of the amateur radio callsign KA9Q?

A: It's the callsign of Phil Karn, who worked on SLIP, congestion control and TCP over amateur radio.

Credit: Alan Cox

Q: Sally Floyd was heavily involved in the design of which TCP enhancement?

A: ECN, see RFC 3042.

Credit: Alan Cox

Q: Who said: "The IETF already has more than enough RFCs that codify the obvious, make stupidity illegal, support truth, justice, and the IETF way, and generally demonstrate the author is a brilliant and valuable Contributor to The Standards Process"?

A: Vernon Schryver, on the mailing list for the tcp-impl IETF working group.

Credit: Alan Cox

Q: What is the minimum MTU that allows any IP datagram to pass?

A: 68 bytes.

Credit: Alan Cox

Q: What is a syncookie and who invented it?

A: Syn cookies help avert synflood attacks by forcing all of the TCP state into the client, invented by Dan Bernstein.

Credit: Alan Cox

Q: Van Jacobson claimed that the TCP receive packet processing fast-path could be done in how many instructions?

A: 30. (33 on Sparc, due to "compiler brain damage.")

Credit: Alan Cox

Q: What would happen if you implemented the TCP URG pointer according to the standard?

Hint: RFC 1122 cleared up the confusion generated by RFC 793.

A: You would lose the last byte of urgent data because the other host implements BSD-style urgent pointers, which point to the byte following the last byte of urgent data.

Credit: Alan Cox

Q: What is an LFN (spelled L-F-N, pronounced "elephant")?

A: Long Fat Network, defined in RFC 1072.

Credit: Alan Cox

Q: Where was John Nagle working when he invented the "Nagle algorithm?"

A: Ford Motor Company.

Credit: Alan Cox

Q: Who invented Tinygram Avoidance?

A: John Nagle. (Tinygram Avoidance is also known as the "Nagle algorithm.")

Q: In TCP, simultaneous open is a transition between which two TCP states?

A: From SYN_SENT to SYN_RCVD.

Credit: Valerie Aurora

Q: What is the ICMP type field for an Echo Request?

A: 8.

Credit: Valerie Aurora

Q: What is the ICMP type field for an Echo Reply?

A: 0.

Credit: Valerie Aurora

Q: What is the maximum number of IP addresses recordable by the IP Record Route option?

A: 9.

Credit: Valerie Aurora

Q: If one end of a TCP connection crashes, and the other end doesn't attempt to send any data, is the resultant TCP connection half-open or half-closed from the point of view of the host that's still up?

A: Half-open.

Credit: Valerie Aurora

Q: In a Christmas tree packet, which TCP flag bits are turned on?

A: SYN, URG, PSH, and FIN (all of them).

Credit: Valerie Aurora

Q: TCP was defined in which RFC?

A: RFC 793, "Transmission Control Protocol."

Credit: Valerie Aurora

Q: What is silly window syndrome?

A: In TCP, when the receiving end continually advertises a tiny window, resulting in data being sent in very small packets.

Credit: Valerie Aurora

Q: If the remote host of a TCP connection does not advertise an MSS, what is the assumed MSS?

A: 536 bytes over IPv4, 1220 over IPv6, although most implementations default to 512 and 1024 respectively.